I agree, it's really not the legislation that should be blamed, it's the crappy websites.
There's no excuse for larger players to not implement these rules. Many smaller players however, struggled and in some cases still struggle with this because some of the rules are rather vague (sometimes intentionally so in order to be future-proof) and hence open for interpretation.
There's the rub: While the law is clearly targeted at larger companies - to the extent some have called it Lex Facebook - it's the smaller companies and hobbyists, for whom implementing GDPR is more of a problem. I wouldn't be surprised if, in the long run, companies such as Facebook actually benefited from GDPR, at the expense of smaller competitors.
That is basically the end effect of any regulation: life gets harder for small players and newcomers.
I would offer the opinion that anti-monopoly regulation is a counterpoint to this.
The US Military News for example, probably won't need the tracking, as they have other intel and income sources, but they are also on the list. I suspect as a political statement.
But maybe note, that I am explaining the possible point of view for this side, not that I take this side. But since I got downvoted allready apparently, this was intellectually too hard for some to understand.